Question packs removed at the root; all subscriptions 4 assistant questions a day; Bazaar is subscription-only

- subscription.0017/0018, payment.0013: pack plans deleted, QuestionCredit/HeartsPass models and Plan.kind /
  question_credits / hearts_days / Order.question_credits / hearts_days dropped. The only paid pack order was the
  company owner's test account (user 26).
- Assistant: no credit spending; quota is the daily cap only (free 2, every plan 4, gift subscription 4).
- Bazaar: verify_purchase is subscription-only (no inapp guess), start/purchase responses lose productType,
  verify refuses an order without a subscription. A paid order with no subscription now logs ERROR.
- Removed POST /api/payment/orders (internal; no caller). Its permission tests stay.
- Pack-based tests rewritten on subscriptions (refund, security, Bazaar token); pack-only test files deleted.
- docs: profit table for 4/day on both payment routes plus free users; handbook, operations, CLAUDE.md current.
949 tests green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/urls.py

@@ -3,7 +3,6 @@ from django.urls import path
 from .views import (
     BazaarStartPurchaseView,
     BazaarVerifyPurchaseView,
-    CreateOrderView,
     InvoiceListView,
     OrderDetailView,
     PaymentRedirectView,
@@ -11,7 +10,6 @@ from .views import (
 )
 
 urlpatterns = [
-    path('payment/orders', CreateOrderView.as_view(), name='payment-create-order'),
     path('payment/zarinpal/callback', ZarinpalCallbackView.as_view(), name='payment-zarinpal-callback'),
     path('payment/bazaar/verify', BazaarVerifyPurchaseView.as_view(), name='payment-bazaar-verify'),
     path('payment/bazaar/orders/<int:order_id>/start', BazaarStartPurchaseView.as_view(),